Security Operations · Topic 1 of 7
Log Sources and SIEM Analysis
Combine log, network, endpoint, cloud and intelligence data in a SIEM through normalization, correlation, time sync and retention to support detection.
- 5 min
- Includes a diagram
- No single log source is complete, so combine them.
- A SIEM collects, normalizes, correlates, alerts and retains evidence.
- Normalization lets a single query work across vendor formats.
What it is
Monitoring depends on data. Each system records part of what happened, and no single source tells the whole story, so analysts combine many of them.
A security information and event management (SIEM) platform collects data from across the environment, standardizes it, correlates events, raises alerts and stores evidence. The skill the exam tests is choosing the right data source for a question and understanding what each can and cannot show.
How it works
Common data sources
| Source | What it tells you | Limit |
|---|---|---|
| Authentication and directory logs | Who signed in, from where, success or failure | Do not show what they did afterwards |
| Endpoint logs and endpoint detection and response (EDR) telemetry | Process starts, file and registry changes, network connections from a host | Only where an agent is installed |
| Firewall, proxy and web gateway logs | Allowed and blocked connections, uniform resource locators (URLs) | Encrypted content is not visible |
| Domain Name System (DNS) logs | Names looked up, odd domains, tunneling | Encrypted DNS may bypass them |
| Network flow records | Who talked to whom, how much, how long | No payload |
| Packet capture | Full detail of traffic | Large and short lived, encrypted payloads stay unreadable |
| Application and database logs | Business actions, errors, data access | Quality depends on developers |
| Cloud audit logs | Control plane actions such as role changes and resource creation | Must be enabled and exported |
| Vulnerability scan results and cloud posture findings | Weaknesses and misconfigurations | Point in time |
| Data loss prevention (DLP) alerts | Sensitive data leaving | Depends on policy coverage |
| Threat intelligence feeds | Known bad addresses, domains, hashes | Can be stale or noisy |
| Third party reports and bug bounty submissions | Outside view of weaknesses | Not continuous |
Missing coverage is itself a finding. If a critical server sends no logs, an attacker there is invisible.
Collection and normalization
Logs arrive in different formats and time zones. Collectors use agents, syslog forwarding or application programming interface (API) pulls.
Normalization maps fields to a common schema, such as source address and user, so one query works across vendors. Parsing errors silently drop data, so monitor the pipeline for gaps and delay.
Time, integrity and retention
Correlation depends on accurate timestamps. Synchronize clocks with Network Time Protocol (NTP) and record the time zone, preferably in coordinated universal time (UTC).
Send logs off the host quickly, since attackers who gain control often delete local logs. Protect stored logs from change, restrict who can read them, and keep them for the period required by policy, regulation or investigation needs.
Retention is a trade off between cost and the ability to look back. Keep recent data in fast storage for searching, and older data in cheaper archive storage.
Aggregation, correlation and enrichment
Aggregation gathers events into one place. Correlation links related events, for example a failed sign in burst followed by a success, a new admin account, and then a large data transfer. Enrichment adds context, such as asset owner, criticality or address reputation, so analysts can rank alerts.
Correlation rules can be based on thresholds, sequences or comparison with a baseline. Shared rule formats, such as Sigma for log detections, let teams reuse detection logic across platforms. Network rule languages like Snort and Suricata signatures, and the YARA language for matching malware patterns in files, serve similar roles for other data types.
Trend analysis and search
Beyond alerts, analysts search historical data. Trend analysis looks for slow changes, such as steady growth in failed sign ins, rising outbound volume or repeated access outside work hours. This catches low and slow activity that single event rules miss.
What to remember for the exam
- No single log source is complete, so combine them.
- A SIEM collects, normalizes, correlates, alerts and retains evidence.
- Normalization lets a single query work across vendor formats.
- Accurate, synchronized time is required to correlate across sources.
- Send logs off the host quickly and protect them from tampering.
- Flow data shows conversations without payload, packet capture shows content but costs storage.
- Cloud audit logs record control plane actions and must be turned on and exported.
- Gaps in logging are a risk, since an unlogged system cannot be investigated.
When the question is "what happened on this host", look at endpoint telemetry. When it is "who talked to what across the network", look at flow data or firewall logs.
Common mistakes
Collecting everything without a purpose. Unfocused data raises cost and noise. Start from detection and response needs.
Ignoring time zones. Mixed time zones make timelines wrong and correlation fail.
Trusting local logs on a compromised host. Attackers can edit or clear them, so rely on forwarded copies.
Treating a threat feed as truth. Indicators age and may flag shared infrastructure, so match them with local evidence.
If log forwarding breaks quietly, the SIEM looks calm when it is simply blind, so alert on missing data.
Check yourself
Work through these three questions.
Why is time synchronization important in a SIEM?
Correlating events across sources and building timelines depends on consistent, accurate timestamps.
What does normalization do?
It maps different log formats to a common schema so queries and rules work across all sources.
Why forward logs off the host immediately?
An attacker who controls the host can alter or delete local logs, but a remote copy keeps the evidence.
Topic 1 of 7 in Security Operations
Test yourself on Security Operations
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.